by Kastro
Paper/Archive/CVE-2025-23351

CVE-2025-23351

NVIDIA BlueField GA — NVIDIA ConnectX and BlueField contain a vulnerability in the command interface where a local user with virtual function (VF) access may c…

EPSS 0.4%CVSS 9.0
critical.is priorityof 100
33
CVSS 9.0 (CNA)9.0 / 10 × 3027.0Not in CISA KEV+300.0EPSS percentile 30.5.305 × 206.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

NVIDIA ConnectX and BlueField contain a vulnerability in the command interface where a local user with virtual function (VF) access may cause a write out of bounds by crafted input. A successful exploit of this vulnerability may lead to arbitrary code execution on the device.

Affected

ProductAffectedFixed inSource
BlueField GAAll versions prior to 46.3008–CNA
BlueField LTS22All versions prior to 35.8002–CNA
BlueField LTS23All versions prior to 39.8002–CNA
BlueField LTS24All versions prior to 43.8002–CNA
ConnectX GAAll versions prior to 46.3008–CNA
ConnectX LTS22All versions prior to 35.8002–CNA
ConnectX LTS23All versions prior to 39.8002–CNA
ConnectX LTS24All versions prior to 43.8002–CNA
ConnectX-4All versions prior to 28.4702–CNA
ConnectX-4 LXAll versions prior to 32.1908–CNA

Scores by source

nvidia (CNA)9.0CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refnvd.nist.gov/vuln/detail/CVE-2025-23351refcve.org/CVERecord?id=CVE-2025-23351refgithub.com/NVIDIA/product-security/tree/main/2026/5699